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This lisiting of claims will replace all prior versions and listings of claims in the 
application. 

AMENDMENTS TO THE CLAIMS 

1 . (Original) A method of tracing data traffic on a network, the method comprising: 
at the transport layer of a protocol stack residing on a first device in the network, 

detecting a transmission or receipt of data to or from a second device on the network; and in 
response to the transmission or receipt being detected, recording the transmission or receipt 
as an entry in a trace log, wherein the trace log is accessible to determine the volume of data 
traveling over a network. 

2. (Original) The method of claim 1, wherein the protocol stack is a TCP/IP stack. 

3. (Original) The method of claim 1, wherein the detection step further comprises 
the step of detecting the presence of an input/output packet representing the transmission o 
receipt. 

4. (Previously Presented) A method of tracing a transmission of data over a 
computer network comprising: detecting a transport-layer request to transmit an input/output 
packet; searching the input/output packet to determine an identity of a process that created the 
input/output packet; and storing in a trace log an entry representing the request, wherein the 
entry comprises the identity of the process, and wherein the trace log is accessible to 
determine a volume of data being transmitted over the network. 

5. (Original) The method of claim 4, further comprising: detecting an 
acknowledgment of the transmission; and in response to the detection of the 
acknowledgment, storing in the trace log an entry representing the completion of the 
transmission. 

6. (Previously Presented) A method of tracing a receipt of data from a computer 
network comprising: detecting a transport-layer request to transmit a packet for an 
input/output connection to a port; searching the packet to determine an identity of a process 
that created the packet; and in response to the detection of a receipt of data at the port, storing 
in a trace log an entry representing the receipt of the data, wherein the entry comprises the 
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process identification, and wherein the trace log is accessible to determine a volume of the 
data being transmitted over the network. 

7. (Original) The method of claim 6, further comprising: creating a connection 
object representing the opening of the port connection by the process; copying the process 
identification from the connection object into a transport control block associated with the 
port; and in response to the detection of the receipt of data at the port, copying the process 
identification into the trace log. 

8. (Original) The method of claim 7, further comprising: copying the process 
identification from the connection object into the transport control block so that the process 
identification is contiguous with the rest of the data in the transport control block. 

9. (Previously Presented) The method of claim 8, further comprising: detecting the 
presence of an input/output request packet indicating that the data receipt is complete; and in 
response to the detection of the completion input/output request packet, making an entry 
representing the receipt of the data into a trace log. 

10. (Currently Amended) A facility for tracing data traffic on a networ k at the 
transport layer , the facility comprising: an identifying means for identifying a process 
causing a transport-layer request to transmit data via the network; and a logging means in 
communication with the identifying means for logging [and] an event, wherein the event 
comprises the identification the process and wherein the logging means is useable to 
determine a volume of data traveling over the network. 

1 1 . (Original) The apparatus of claim 10 wherein the identifying means further 
comprises means for communicating with a transport layer of a protocol stack. 

12. (Original) A computer-readable medium having stored thereon computer- 
executable instructions for performing steps comprising: at the transport layer of a protocol 
stack residing on a first device in the network, detecting a transmission or receipt of data to or 
from a second device on the network; and in response to the transmission or receipt being 
detected, recording the transmission or receipt as an entry in a trace log, wherein the trace log 
is accessible to determine the volume of data traveling over a network. 
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13. (Original) The computer-readable medium of claim 12, wherein the protocol 
stack is a TCP/IP stack. 

14. (Original) The computer-readable medium of claim 12, having further computer- 
executable instructions for performing the step of detecting the presence of an input/output 
packet representing the transmission or receipt. 

15. (Previously Presented) A computer-readable medium having stored thereon 
computer-executable instructions for performing steps comprising: detecting a transport- 
layer request to transmit an input/output packet; searching the input/output packet to 
determine an identity of a process that created the input/output packet; and storing in a trace 
log an entry representing the request, wherein the entry comprises the identity of the process, 
and wherein the trace log is accessible to determine a volume of data being transmitted over 
the network. 

16. (Original) The computer-readable medium of claim 15, having further computer- 
executable instructions for performing the step of detecting the presence of the input/output 
packet at the transport layer of a protocol stack. 

17. (Original) The computer-readable medium of claim 15, having further computer- 
executable instructions for performing the step of detecting an acknowledgment, storing in 
the trace log an entry representing the completion of the transmission. 

18. (Previously Presented) A computer-readable medium having stored thereon 
computer-executable instructions for performing the steps comprising: detecting a transport- 
layer request to transmit a packet for an input-output connection to a port; searching the 
packet to determine an identity of a process that created the packet; and in response to the 
detection of a receipt of data at the port, storing in a trace log an entry representing the receipt 
of the data, wherein the entry comprises process identification, and wherein the trace log is 
accessible to determine the volume of the data being transmitted over the network. 

19. (Original) The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the steps of: creating a connection object representing 
the opening of the port connection by the process; copying the process identification from the 
connection object into a transport control block associated with the port; and in response to 
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the detection of the receipt of data at the port, copying the process identification into the trace 
log. 

20. (Original) The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the step of copying the process identification from the 
connection object into the transport control block so that the process identification is 
contiguous with the rest of the data in the transport control block. 

21. (Original) The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the steps of: detecting the presence of an input/output 
request packet indicating that the data receipt is complete; and in response to the detection of 
the completion input/output request packet, storing in the trace log an entry representing the 
receipt of the data. 

22. (Previously Presented) The method of claim 1 , wherein the transmission of data 
is recorded at the completion of the transmission indicated by an acknowledgment from the 
first device. 

23. (Canceled) 

24. (Previously Presented) The method of claim 4, wherein the identity of the 
process includes a port number or an IP address relating to the transmission. 



